CVE-2021-47935
📛 CVE Title
(no title)
Description
Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 8.8 / 10
- CVSS vector
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.8 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2021-47935
- Linked Threat
- CVE-2021-47935 — CVE-2021-47935
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-10 13:16:29 UTC
- NVD last modified
- 2026-05-14 17:16:03 UTC
- NVD CVSS v3.1
- 8.8 / 10 HIGH source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0042 (probability of exploitation in next 30 days)
- EPSS percentile
- 61.87% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-94
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-24 23:58 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2021-34796 - Assigner
- VulnCheck
- Published
- May 10, 2026, 12:43:54 PM
- Updated
- May 11, 2026, 2:44:21 PM
- EUVD base score (CVSS 4.0)
-
8.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.4200
- Vendors
- Sentry
- Products
-
sentry (8.2.0)sentry (8.2.0)
ENISA description: Sentry 8.2.0 contains a remote code execution vulnerability that allows authenticated superusers to execute arbitrary commands by injecting malicious pickle-serialized objects through the audit log entry data parameter. Attackers can submit crafted POST requests to the admin audit log endpoint with base64-encoded compressed pickle payloads in the data field to achieve code execution with application privileges.
Affected products — CPE 2.3 (1) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:sentry:sentry:8.2.0:*:*:*:*:*:*:*
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
MITRE references (1) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- ExploitDB-50318 exploit
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2021-47935 tenable:nvd.nist.gov
- https://sentry.io/welcome/ tenable:sentry.io
- https://www.cve.org/CVERecord?id=CVE-2021-47935 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/sentry-remote-code-execution-via-pickle-deserialization tenable:www.vulncheck.com
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://sentry.io/welcome/ disclosure@vulncheck.com Product
- https://www.exploit-db.com/exploits/50318 disclosure@vulncheck.com ExploitVDB Entry
- https://www.vulncheck.com/advisories/sentry-remote-code-execution-via-pickle-deserialization disclosure@vulncheck.com Third Party Advisory
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.talosintelligence.com
Microsoft has released its monthly security update for August 2025, which includes 111 vulnerabilities affecting a range of products, including 13 that Microsoft marked as "critical".
2026-05-26 02:51 UTC -
web:cyberscoop.com
Threats Microsoft addresses 137 vulnerabilities in May's Patch Tuesday, including 13 rated critical The high volume of vulnerabilities reflects a growing trend researchers have been anticipating as artificial intelligence models are deployed to find previously uncovered defects in code.
2026-05-26 02:51 UTC -
web:cybersecuritynews.com
No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared. Windows BitLocker Security Bypass The vulnerability originates in WinRE's handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.
2026-05-26 02:51 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-05-26 02:51 UTC -
web:support.microsoft.com
Branch History Injection Mitigation settings for Windows Server and Azure Stack HCI Security advisories (ADVs) and CVEs provide information provide information about the risk that is posed by these vulnerabilities. They also help you identify the vulnerabilities and identify the default state of mitigations for Windows Server systems.
2026-05-26 02:51 UTC -
web:support.microsoft.com
Provides Windows client guidance for IT Pros to protect against speculative execution side-channel vulnerabilities.
2026-05-26 02:51 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's August 2025 Patch Tuesday, which includes security updates for 107 flaws, including one publicly disclosed zero-day vulnerability in Windows Kerberos.
2026-05-26 02:51 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.
2026-05-26 02:51 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-26 02:51 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 02:51 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.